CloudSEK published a report on 28 October 2026 about a botnet it calls Doorway. In October its researchers found two identical open directories left exposed by the operators, holding about 41 GB of working data: source code, scan results, logs and notes. That gives an unusually direct look at how a campaign against home and small office network gea
Kaspersky's Global Research and Analysis Team (GReAT) published details on 28 October 2026 of a denial-of-service flaw in several Intelbras IP cameras. Intelbras is a Brazilian brand, and its Mibo Smart app has more than 4 million downloads. Most users are in Brazil, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay
On 26 October 2026 CERT Polska published 11 vulnerabilities in boneIO products, CVE-2026-77052 to CVE-2026-77062. They affect the boneIO Black controller software and the black_debian_images system image, and boneIO fixed them in version 1.6.0. The flaws were reported by Mateusz Włodarczak (s3ga), and CERT Polska coordinated the disclosure. The adv
Most advice on smart home security starts after the device is already on your network: change the password, put it on a separate VLAN, update the firmware. Some of the most important decisions are made earlier, in the shop. A camera that never gets another firmware update, or a plug that stops working the day its cloud service shuts down, cannot be
Almost every smart plug, camera, TV and robot vacuum looks up domain names before it talks to a cloud server. If those lookups go through a DNS server you control, you get a running list of what each device contacts and how often, and you can block domains for selected devices only. Pi-hole is a free DNS server built for exactly this, and it runs w
Camera software running on an ordinary Windows PC can be the way into a whole network. On 27 October 2026 security company Huntress described several incidents from September and October in which attackers got in by compromising a camera management program, a Windows client used to view and manage video from cameras and recorders.
Baseus has a new camera for people who cannot drill into an outside wall. On 27 October 2026 Digital Trends reported the launch of the PrimeSentinel W1, a camera that sticks to the inside of a window and watches the street, garden or driveway through the glass. It costs $69.99 and went on sale in the US the same day.
Owners of Schlage smart locks will soon be able to hand out temporary PIN codes straight from Home Assistant. On 27 October 2026 a pull request by Aaron (abpei) that adds scheduled access codes to the Schlage integration was merged into Home Assistant's development branch. It was reviewed by MartinHjelmare, epenet, iluvdata and joostlek.
The "Home Assistant" LLM API, the admin-only toolset for AI agents that arrives in Home Assistant 2026.11, is no longer read-only. On 27 October at 20:45 Polish time, Franck Nijhof merged a pull request by Paulus Schoutsen that adds a tool for calling any action. A day earlier a second tool landed that lets the agent search for actions first.
